The bastion is the boundary

Management traffic is private

SSH, database administration, cluster control, runner configuration, and operator interfaces do not need public addresses. The zero-trust rule is simple: a managed deployment is not reachable on a public IP for management traffic.

Public exposure is reserved for an application route that a recipe explicitly declares public.

A bastion is a scoped path

The bastion accepts an authenticated connection, checks the grant, and forwards only the permitted port to the private service. The client can use a local listener while the service keeps its private address.

A grant can be narrower than access to the whole host. That is useful for a database console, an observability endpoint, or a temporary operator session.

Identity and mesh are separate checks

The mesh proves that the peer is on the allowed network. The access policy decides whether that identity can reach this deployment and this service. The service still performs its own authentication.

Layering these checks means that joining the mesh is not the same as receiving access to every workload.

Audited access when needed

Customers that need recorded operator sessions can use the bastion path as the place where session policy and recording apply. The resulting record can be connected to the deployment event and the identity that received the grant.

No public SSH workaround

Opening port 22 and relying on key strength is not the default recovery plan. A broken mesh is an operational incident with a break-glass procedure, not a reason to make every deployment publicly reachable.